csrf

What is csrf?

The csrf npm package is used to generate and validate CSRF (Cross-Site Request Forgery) tokens to protect web applications from CSRF attacks. It is commonly used in conjunction with web frameworks like Express to ensure that requests made to the server are legitimate and not forged by malicious actors.

What are csrf's main functionalities?

Generate CSRF Token

This feature allows you to generate a CSRF token. First, you create a new instance of the csrf class, then generate a secret, and finally create a token using that secret.

const csrf = require('csrf');
const tokens = new csrf();
const secret = tokens.secretSync();
const token = tokens.create(secret);
console.log('CSRF Token:', token);

Validate CSRF Token

This feature allows you to validate a CSRF token. You generate a secret and a token, and then use the verify method to check if the token is valid.

const csrf = require('csrf');
const tokens = new csrf();
const secret = tokens.secretSync();
const token = tokens.create(secret);
const isValid = tokens.verify(secret, token);
console.log('Is the token valid?', isValid);

Other packages similar to csrf

csurf

The csurf package is another middleware for CSRF token creation and validation, specifically designed to work with Express.js. It provides similar functionality to csrf but is more tightly integrated with Express, making it easier to use in Express applications.

csrf-csrf

The csrf-csrf package is a lightweight alternative for CSRF protection. It offers similar functionalities to csrf but is designed to be simpler and more straightforward, making it a good choice for smaller projects or those that do not require the full feature set of csrf.

README

CSRF

Logic behind CSRF token creation and verification.

Read Understanding-CSRF for more information on CSRF. Use this module to create custom CSRF middleware.

Looking for a CSRF framework for your favorite framework that uses this module?

• Express/connect: csurf or alt-xsrf
• Koa: koa-csrf or koa-atomic-session

Install

$ npm install csrf

API

var Tokens = require('csrf')

new Tokens([options])

Create a new token generation/verification instance. The options argument is optional and will just use all defaults if missing.

Options

Tokens accepts these properties in the options object.

saltLength

The length of the internal salt to use, in characters. Internally, the salt is a base 62 string. Defaults to 8 characters.

secretLength

The length of the secret to generate, in bytes. Note that the secret is passed around base-64 encoded and that this length refers to the underlying bytes, not the length of the base-64 string. Defaults to 18 bytes.

tokens.create(secret)

Create a new CSRF token attached to the given secret. The secret is a string, typically generated from the tokens.secret() or tokens.secretSync() methods. This token is what you should add into HTML <form> blocks and expect the user's browser to provide back.

var secret = tokens.secretSync()
var token = tokens.create(secret)

tokens.secret(callback)

Asynchronously create a new secret, which is a string. The secret is to be kept on the server, typically stored in a server-side session for the user. The secret should be at least per user.

tokens.secret(function (err, secret) {
  if (err) throw err
  // do something with the secret
})

tokens.secret()

Asynchronously create a new secret and return a Promise. Please see tokens.secret(callback) documentation for full details.

Note: To use promises in Node.js prior to 0.12, promises must be "polyfilled" using global.Promise = require('bluebird').

tokens.secret().then(function (secret) {
  // do something with the secret
})

tokens.secretSync()

A synchronous version of tokens.secret(callback). Please see tokens.secret(callback) documentation for full details.

var secret = tokens.secretSync()

tokens.verify(secret, token)

Check whether a CSRF token is valid for the given secret, returning a Boolean.

if (!tokens.verify(secret, token)) {
  throw new Error('invalid token!')
}

License

MIT